Analysis
- user interaction
yes - max time kernel
150s - max time network
127s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/09/2026, 18:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
skeet.exe
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
skeet.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target skeet.exe
- Size 6.7MB
- Sample260930-xdsmcsfe69
- SHA256 19c0612de3c2fef0282e2f6d8f248c139e56703be2009cbc3c186c30ea0663c4
- MD5 28419e21a48bf9c02ee9cdf4a0b530e2
- SHA1 00719f33641105142983a83fc41ff2e88991d6ec
- SHA512 62d128418ff552e511082b7fcf4606859ff6770d595b7d898cde2d74ee02bc899ca6c070e911157c834d917183dcecaa074ddca2a2b3568a0db5cf388a8ec900
- SSDEEP 98304:WTuNIbj8TzTf8BWMSEQ1St6DFSPX9uBXrD83j/:WTuN2o8AOJ6BQ6rwz/
- TLSH T12966BF03F79651EED02BC47886A75727E631744A0B319ADB13C46B352EA37E01F3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings skeet.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe 3772 skeet.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3772 skeet.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 968 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\skeet.exe"C:\Users\Admin\AppData\Local\Temp\skeet.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3772
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:968